Privacy Policy

1. About This Policy

This Privacy Policy explains what data the Calendar for Nextcloud extension ("the Extension", "we", "our") collects, stores, and shares — and what it does not. It is written in plain language so you know exactly what is happening with your data. By installing or using the Extension you acknowledge that you have read and understood this policy. If you disagree with it, please uninstall the Extension.

2. About Calendar for Nextcloud

Calendar for Nextcloud is a Chrome extension that gives you fast, private access to your Nextcloud Calendar directly from your browser toolbar. It connects exclusively to the Nextcloud server you configure and lets you:

• Browse upcoming events across all your calendars.
• Create events using natural language (e.g. "Team call at 3pm tomorrow").
• Manage multiple calendars — including subscribed ICS feeds and holiday calendars.
• Receive desktop notifications for upcoming events.
• Add events via right-click context menu on any web page.

The Extension does not generate content, host a server, collect analytics, or transmit any of your data to the developer.

3. Data We Collect

The Extension stores the following data locally on your device only:

• Nextcloud credentials — your server URL, username, and a Nextcloud-issued app password. Your main Nextcloud account password is never requested, seen, or stored. All credentials are encrypted with AES-256-GCM before being saved to chrome.storage.local.
• Calendar and event data — your calendar list and events, cached locally for offline access and efficient syncing. Event content (titles, descriptions, locations) is also encrypted at rest.
• Display preferences — theme, font size, sync interval, timezone — stored unencrypted as they contain no personal information.
• Optional PIN — if you enable PIN protection, only a SHA-256 hash of the PIN is stored. The raw PIN is never saved anywhere.

None of this data ever leaves your device except as part of the direct, encrypted HTTPS connection to your own Nextcloud server or to external ICS calendar sources you have personally subscribed to.

4. Data We Do NOT Collect

We do not collect, transmit, or store any of the following:

• Personal identifiers such as your name, email address, IP address, or device ID.
• Usage data, telemetry, crash reports, or analytics of any kind.
• Browsing history or activity on other websites.
• Your calendar events or personal data — outside your own device and your own Nextcloud server.
• Payment or financial information.

The Extension contains no analytics SDKs, no tracking pixels, no third-party advertising, and makes no outbound network requests except to your configured Nextcloud server, any external ICS calendar feeds you have personally subscribed to, and the Polar.sh donate service described in Section 6.

5. Chrome Permissions — Why We Request Them

The Extension requests the following Chrome permissions:

• storage — Saves your encrypted credentials, cached calendar data, and display preferences to chrome.storage.local.
• alarms — Schedules periodic background syncs with your Nextcloud server at the interval you choose (default: every 15 minutes).
• tabs — Opens the Nextcloud Login Flow page in a new tab during initial authentication, then closes it automatically after approval.
• contextMenus — Adds a "Add to Calendar" option to your right-click menu so you can create events from selected text on any page.
• notifications — Displays desktop notifications for upcoming events, with Snooze and Dismiss actions.
• optional_host_permissions (<all_urls>) — Requested at runtime, when needed. Required to allow the Extension to reach your Nextcloud server (on any domain you choose) and to fetch external ICS calendar feeds you have subscribed to (such as public holiday calendars). Without this permission, subscribed and holiday calendars cannot load their events. No access is used to read or interact with any other website you visit.

6. Third-Party Services

Your Nextcloud server — All calendar data is synced directly with the Nextcloud server you configure. The Extension communicates exclusively with that server on your behalf. Nextcloud's own privacy policy applies to how your server handles data.

External ICS calendar feeds — If you subscribe to external ICS feeds (e.g. public holiday calendars from thunderbird.net or any other source), the Extension fetches those feeds directly from their respective servers. The Extension does not control those servers. You are subject to each feed provider's own privacy policy.

Polar.sh (optional donations) — The Settings page includes an optional "Support the project" donate button powered by Polar.sh. If you choose to donate:

• Clicking the button loads a Polar.sh checkout widget. You interact directly with Polar.sh and their privacy policy applies.
• The Extension itself receives no payment data and stores nothing from the donation flow.
• Donating is entirely optional and has no effect on extension functionality.

Polar.sh privacy policy: https://polar.sh/legal/privacy

7. Trademark & Affiliation Disclaimer

"Nextcloud" and the Nextcloud logo are registered trademarks of Nextcloud GmbH. This extension is an independent community project and is not affiliated with, endorsed by, or supported by Nextcloud GmbH in any official capacity. Use of the Nextcloud name is nominative fair use to describe interoperability only. All trademarks belong to their respective owners.

8. Your Rights & Control Over Your Data

Because all data is stored locally on your device, you have complete control:

• Access: Open the extension Settings page to view your connected server and stored preferences.
• Delete: Click "Disconnect" in Settings to wipe all stored credentials and cached calendar data instantly. Uninstalling the extension removes all stored data from your device.
• Portability: Your data lives in Chrome's local storage on your own device — no account, export request, or permission from us is needed to access or move it.
• No account required: This extension does not require you to create an account with the developer. Your only account is with your own Nextcloud server.

9. Children's Privacy

The Extension is not directed at children under the age of 13 (or 16 in the European Union). We do not knowingly collect any information from children. If you believe a child has used this Extension and you have concerns, please contact us at the address in Section 15.

10. Security

We take security seriously:

• Credentials and event content are encrypted on-device using AES-256-GCM via the browser's built-in Web Crypto API before being saved to storage.
• A random 12-byte IV is generated per encryption operation and stored alongside the ciphertext.
• The optional PIN is stored only as a SHA-256 hash — the raw PIN is never saved anywhere.
• All communication with your Nextcloud server uses HTTPS.
• The published extension includes integrity checks (SHA-256 file hashes) that halt execution if any file has been tampered with after installation.

Despite these measures, no security measure is 100% effective. If you discover a security issue, please contact us privately before disclosing it publicly.

11. Transparency & Open-Source Intent

The source code for this extension is available for inspection. The extension contains no minified third-party bundles from external CDNs, no dynamically loaded scripts, and no eval() calls. The published build is optimised and minified for performance, but the original source code remains auditable on request.

12. Legal Rights, Fair Use & DMCA

All original code in this extension is copyright of its author. The extension communicates with Nextcloud's standard CalDAV and CardDAV APIs solely to provide calendar interoperability. It does not scrape, harvest, circumvent access controls, or interfere with any server in an unauthorised way. If you believe any content in this extension infringes your rights, please contact us at the address in Section 15 with a description of the concern and we will respond promptly.

13. International Users & GDPR

This extension stores data only on your local device and does not transmit personal data to any server we control. As such, standard data-controller obligations under GDPR, CCPA, or similar regulations do not apply to us. If you use this extension within the EU, your data remains on your own device and is processed by your own Nextcloud server under your own control. For data held by your Nextcloud server, please refer to your server administrator or Nextcloud's own privacy documentation.

14. Changes to This Policy

We may update this policy as the extension evolves. The "Effective Date" at the top will reflect any changes. Continued use of the extension after an update constitutes acceptance of the revised policy. For significant changes we will include a note in the Chrome Web Store release notes.

15. Contact

For privacy questions, bug reports, feature requests, or any other feedback:

We aim to respond to all inquiries within 5 business days.